What Does HIPAA Really Say About Information Security?

HIPAA regulations require healthcare organizations to keep patient information secure and private, but what does this act really say about information security? The requirements, as written, are open to interpretation.

HIPAA leaves a lot of the details up to the organization, with the understanding that covered entities will follow common sense rules when they put their information security practices in place. “Reasonable safeguards” is the term the act uses for this purpose.

Information Disposal

What happens when a covered entity needs to dispose of sensitive information? The technical, administrative, and physical requirements can vary significantly between healthcare organizations. However, their policies and procedures need to cover the following areas:

• The systems and media used to store and distribute electronic protected health information (PHI) must have a procedure in place to completely remove this data before the hardware may be reused.
• Staff members involved in the disposal process have to go through appropriate training that covers exactly what’s involved in safely disposing of this data. Both the employees directly handling the process and those in a management position must take this training.
• The PHI records can’t be thrown away in receptacles that are publicly accessible or otherwise at risk for unauthorized access. However, HIPAA does not say specifically how healthcare organizations should handle the final step of the process.

The Penalties for Not Meeting HIPAA Requirements

HIPAA is strict about not allowing PHI to end up in situations where it could be viewed by someone without the proper authorization to do so. Both willful and accidental releases of patient information can be fined, according to the current regulations.

The fines and penalties range up to $250,000 and ten years in jail, although this is the most extreme punishment reserved for those who used their access to the information for personal or malicious gain. Even one HIPAA fine can be disastrous for smaller practices, so it’s important that covered entities have their bases covered when they put together their compliance strategy for PHI.

Why HIPAA Shredding is an Ideal Disposal Method

HIPAA shredding services from FileShred solve many of the problems that healthcare organization face with compliant disposal procedures. This process renders physical records completely unreadable, even before they get thrown away. Even if someone did get access to the shredded papers, it would be impossible to put together any sensitive information. These services even shred up devices such as hard drives so that the electronic PHI can be handled at the same time as the rest of the documents.

As your HIPAA shredding company, FileShred takes the pieces away for you, so you don’t end up trying to safely store the leftovers securely. It’s an end-to-end service that gives medical organizations the peace of mind they need when working with countless pieces of sensitive patient information.

This facilitated HIPAA compliance service allows everyone to focus on the task at hand, rather than trying to figure out what’s going to happen to the medical records afterward. With a regularly scheduled HIPAA shredding appointment, you can also avoid old records piling up in space that could be used for another examination room or office.

HIPAA regulations and the associated penalties may be a frustrating aspect of running a medical office, but it’s important to keep PHI safe at all times. HIPAA shredding services from FileShred is the best option available for being proactive about compliance. Contact us today to learn more and get started!